Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/moasq/agentic-ship/upstream-syncnpx skills add moasq/agentic-ship --skill upstream-syncgit clone --depth 1 https://github.com/moasq/agentic-shipWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00048 | $0.01394 |
| Opus 5 | $0.00024 | $0.00697 |
| Sonnet 5 | $0.00010 | $0.00279 |
| Haiku 4.5 | $0.00005 | $0.00139 |
Grade A, and why
upstream-sync scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Upstream Sync
Downstream contract: paths like
src/andconvex/refer to the product workspace that adopts Agentic Ship, not this tool repo.
A bundle is only worth what it was worth on the day it was downloaded — unless it can update itself. This skill is the difference between a template and a maintained tool.
skills.lock.json is the manifest. Nothing enters the bundle without an entry there.
1. Skills
For each entry under skills — an entry covers the SKILL.md and the files listed
in its references array; they sync as one unit, never separately:
upstream: "original"→ authored here. Nothing to sync; note it and move on.- Otherwise, fetch the upstream at its latest release or ref.
- No local patches (
patched: false) → diff against the vendored copy. If it changed, replace it and bumprefandlastSync. - Local patches (
patched: true) → three-way diff between the base ref, upstream latest, and the local copy. Show the diff, re-apply the local patch on top, and ask before committing. Never silently overwrite a patched file. - Upstream archived, moved, or deleted → report CRITICAL, propose a replacement, change nothing.
- No local patches (
2. MCP servers
For each entry under mcp:
pnpm view <package> versionversus the pin.- Patch and minor bumps → fine, note them.
- Major bumps → flag as breaking. Read the upstream changelog before updating, and say what changed in the report.
- Remote servers (stripe, resend, posthog, 21st) → confirm the documented URL
and auth scheme still match what is in
.mcp.json. Vendors do migrate; that is exactly how the old Magic MCP configuration went stale. For 21st,GET /.well-known/oauth-protected-resource/api/mcpmust still return an authorization server — that metadata is what lets the host authorize by browser instead of by key, and losing it silently would put an API key back in the buyer's hands.
3. Registries
Every URL under registries in both components.json and skills.lock.json must
return HTTP 200. A dead registry is reported, never quietly replaced with hand-written
components.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 121 lines · 48 tokens per session scan A a1249a3c294e
upstream-sync is a skill published in the GitHub repository moasq/agentic-ship (10 stars, last pushed 4d ago), licensed MIT. It adds 48 tokens to every session and 1,394 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
paperclip
Interact with the Paperclip control plane API for task coordination and governance. Use when checking assignments, updating issue status, posting comments, delegating work, managing routines, or calling Paperclip API endpoints.
omni-mcp
Connect to the OmniRoute MCP server (110 tools, 3 transports: SSE/stdio/HTTP). Covers routing, cache, compression, memory, skills, providers, and audit tools across 33 permission scopes.
add-resend
Add Resend (email) channel integration via Chat SDK.
codegen
Code generation utilities for json-render. Use when generating code from UI specs, building custom code exporters, traversing specs, or serializing props for @json-render/codegen.
agui-dotnet-sample-step
Add a GettingStarted sample Step (a Server/Client pair) to the AG-UI .NET SDK that demonstrates one protocol feature the way we want users to write it. USE FOR: adding a new samples/GettingStarted/StepNN Server+Client pair, wiring it into AGUI.slnx and the integration-test project, giving it a deterministic…
a-evolve
Apply A-Evolve's agentic evolution methodology to improve AI agent performance across runs. Use when the user wants to diagnose agent failures, generate targeted skills from error patterns, evolve system prompts, or accumulate episodic knowledge. Works standalone or inside AutoResearchClaw pipelines. Triggers on…